fullcourtdefense-cli 1.25.0 → 1.25.2

package/dist/commands/daemon.js

@@ -1528,22 +1528,34 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask) {
+    if (viaTask && !windowsTaskRunsInteractive(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
         // never stop or supersede.
+        //
+        // ONLY when the task is windowless (S4U): starting an InteractiveToken
+        // task runs node.exe on the interactive desktop, and since the daemon
+        // never exits, that console window stays OPEN on the user's screen — the
+        // "open console at the end of installation" customer complaint. Fresh
+        // unelevated installs register InteractiveToken (S4U needs elevation), so
+        // those take the hidden WMI path below instead; the MSI's SYSTEM-context
+        // migration flips the task to S4U moments later, and every subsequent
+        // task start is windowless. Elevation is not a concern here: when the
+        // caller IS elevated, S4U registration succeeded and this branch is taken.
         const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
         if (run.status === 0)
             return;
     }
     // WMI process creation escapes the MSI job object. Runs node.exe DIRECTLY —
-    // no wscript/VBS (Defender's Commando.A!ml heuristic) — with a hidden window.
+    // no wscript/VBS (Defender's Commando.A!ml heuristic). Win32_ProcessStartup
+    // ShowWindow=0 (SW_HIDE) is REQUIRED: without it Win32_Process.Create gives
+    // the console app a visible window on the interactive desktop.
     const nodeEsc = process.execPath.replace(/'/g, "''");
     const entryEsc = cliEntry().replace(/'/g, "''");
     (0, child_process_1.spawnSync)('powershell', [
         '-NoProfile', '-NonInteractive', '-Command',
-        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('\"' + '${nodeEsc}' + '\" \"' + '${entryEsc}' + '\" daemon') } | Out-Null`,
+        `$si = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{ ShowWindow = [uint16]0 }; Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('\"' + '${nodeEsc}' + '\" \"' + '${entryEsc}' + '\" daemon'); ProcessStartupInformation = $si } | Out-Null`,
     ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
 }
 function installWindows() {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.25.0"
+  "version": "1.25.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.25.0",
+  "version": "1.25.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {